CVE-2014-7810
Published: 07 June 2015
The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation.
From the Ubuntu security team
It was discovered that the Tomcat Expression Language (EL) implementation incorrectly handled accessible interfaces implemented by inaccessible classes. An attacker could possibly use this issue to bypass a SecurityManager protection mechanism.
Priority
Medium
Status
| Package | Release | Status |
|---|---|---|
|
tomcat6 Launchpad, Ubuntu, Debian |
Upstream |
Released
(6.0.41-3)
|
| Ubuntu 18.04 LTS (Bionic Beaver) |
Does not exist
|
|
| Ubuntu 16.04 ESM (Xenial Xerus) |
Released
(6.0.45+dfsg-1)
|
|
| Ubuntu 14.04 ESM (Trusty Tahr) |
Released
(6.0.39-1ubuntu0.1)
|
|
|
Patches: Upstream: http://svn.apache.org/viewvc?view=revision&revision=1645366 Upstream: http://svn.apache.org/viewvc?view=revision&revision=1659538 |
||
|
tomcat7 Launchpad, Ubuntu, Debian |
Upstream |
Released
(7.0.61-1)
|
| Ubuntu 18.04 LTS (Bionic Beaver) |
Not vulnerable
(7.0.61-1)
|
|
| Ubuntu 16.04 ESM (Xenial Xerus) |
Not vulnerable
(7.0.61-1)
|
|
| Ubuntu 14.04 ESM (Trusty Tahr) |
Released
(7.0.52-1ubuntu0.3)
|
|
|
Patches: Upstream: http://svn.apache.org/viewvc?view=revision&revision=1644019 Upstream: http://svn.apache.org/viewvc?view=revision&revision=1645644 |
||
|
tomcat8 Launchpad, Ubuntu, Debian |
Upstream |
Released
(8.0.21-2)
|
| Ubuntu 18.04 LTS (Bionic Beaver) |
Not vulnerable
(8.0.22-2)
|
|
| Ubuntu 16.04 ESM (Xenial Xerus) |
Not vulnerable
(8.0.22-2)
|
|
| Ubuntu 14.04 ESM (Trusty Tahr) |
Does not exist
|
|
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7810
- http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.44
- http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.59
- http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.17
- https://ubuntu.com/security/notices/USN-2655-1
- https://ubuntu.com/security/notices/USN-2654-1
- NVD
- Launchpad
- Debian